Describe your business, leave with a checklist you can assign

Special care-required personal information — such as creed, medical history and criminal record — may only be acquired with the individual’s prior consent, subject to statutory exceptions. For AI companies, scraping public web pages containing health, religious or political content for training is not exempted merely because the content is public; each case must be checked against the exceptions.

Evidence: Detection and filtering rules for special care-required information; Consent records or assessment of the exception relied on; Sampling review report on sensitive content in the dataset

Implement organisational, personnel, physical and technical security control measures over the personal data handled, to prevent leakage, loss or damage; where handling is entrusted abroad, the operator must also understand the relevant foreign regime and take necessary and appropriate measures.

Evidence: Security control measures procedure covering all four categories; Record of the survey of the foreign regime where handling occurs; Access control and log audit records; Employee confidentiality undertakings and training records

Where a leakage, loss or damage event of the kind prescribed by PPC rules occurs — one posing a substantial risk to individuals’ rights and interests — the operator must report to the PPC as prescribed and notify the affected individuals, unless notification is difficult and substitute protective measures are taken. A contractor that notifies the entrusting operator is relieved of reporting itself. Reporting is in two stages, a prompt report and a definitive report.

Evidence: Incident response plan including the Japanese reporting path; Records of the prompt and definitive reports filed; Notice text to individuals and proof of dispatch; Justification and records of any substitute protective measures

AI incident and serious incident reporting record (register plus report drafts)

Providing personal data to a third party in a foreign country in principle requires the individual’s prior consent to that provision, and before obtaining consent the operator must supply information about the personal-information regime of that country, the protective measures taken by the recipient and other reference information, as prescribed by PPC rules. Two exceptions apply: the recipient country is designated by PPC rules as having a regime at an equivalent level to Japan; or the recipient has established a system meeting PPC-prescribed standards for continuously implementing equivalent measures. Where the latter is relied on, the provider must take the measures necessary to ensure those equivalent measures continue and must supply information about them on request.

Evidence: Information supplied to individuals about the foreign regime and the recipient’s protective measures; Consent records including time and scope of consent; Equivalent-measures system documentation: contract, internal rules and a gap-mapping table; Annual confirmation record of continued implementation; Records of responses to individuals’ requests for information

Open tool: Transfer Matrix

Specify the purpose of use as far as possible when acquiring personal information and make it public or notify the individual; any change must stay within a scope reasonably related to the original purpose and be re-notified. Before using Japanese user data for model training, confirm that training falls within the published purpose of use, otherwise extend the purpose or obtain consent first.

Evidence: Japanese-language privacy policy and published purpose-of-use page; Assessment record of the reasonable relatedness of any purpose change; Mapping of model-training uses to the published purposes

Where all or part of the handling of personal data is entrusted to another party, the entrusting operator must exercise necessary and appropriate supervision — in practice, selecting the contractor appropriately, concluding a contract containing security requirements, and keeping track of how the contractor actually handles the data. A Chinese AI company acting as contractor to a Japanese customer must be ready to be supervised and audited.

Evidence: Entrustment agreement with security and sub-contracting clauses; Contractor selection assessment record; Periodic handling-status reports and onsite or remote audit records; Sub-contracting approval records

Article 171 provides that the Act also applies where a personal information handling business operator, pseudonymously processed information handling operator, anonymously processed information handling operator or personally referable information handling operator handles, in a foreign country, the personal information of a person in Japan — or personally referable information to be acquired as such, or pseudonymously or anonymously processed information created from it — in connection with supplying goods or services to persons in Japan. Operators abroad therefore need a working capability to receive individuals’ requests and to respond to PPC enquiries and reporting requirements.

Evidence: Extraterritoriality assessment memo linking business activity to users in Japan; Japanese-language contact channel and internal response-time rules; Register of individuals’ requests; PPC enquiry response plan and designated authorised contact

The new exception permits third-party provision of personal data, and acquisition of publicly available sensitive information, without consent, provided the data is secured for use solely in creating statistical information — expressly including AI development that can be characterised as statistics creation. The accompanying controls are: publication of specified items (the name of the acquirer, or of the provider and recipient, and the content of the intended statistics creation); for third-party provision, a written agreement between provider and recipient that the provision is solely for statistics creation; and a prohibition on the acquirer and recipient using or re-providing the data for any other purpose. The precise scope and publication items are to be set by PPC rules.

Evidence: Published page stating the statistics-creation purpose, with archived copies; Written provider-recipient agreement limiting the provision to statistics creation; Technical and process controls preventing use or re-provision for other purposes; Description of the statistical processing pipeline with output samples; Internal legal assessment memo on the scope of the exception

Operators handling face-feature data must publicise specified items: the operator’s name, address and representative, the fact that face-feature data is handled, the purpose of use, the bodily characteristics the data derives from, and the procedure for responding to suspension requests. The grounds for an individual to demand suspension are relaxed so that no unlawful act need be shown, and providing face-feature data to third parties under the opt-out regime is prohibited. The method of publicity and the precise scope are to be set by cabinet order and PPC rules.

Evidence: Text of the face-feature-data notice and record of where it is published; Register of face-feature data processing: source characteristics, purpose, retention period; Records of suspension requests received and executed; System configuration evidence blocking opt-out third-party provision

The amendment imposes an express duty on contractors not to handle entrusted personal data beyond the scope necessary to perform the entrusted work, save where required by law or where urgently necessary for saving life, disaster relief or responding to an emergency. In parallel, where the entrustment contract agrees the entirety of the handling method and the measures enabling the entrusting operator to keep track of the contractor’s handling, that contractor is in principle exempted from the Chapter 4 obligations — but the no-excess-scope duty and the security control duty continue to apply.

Evidence: Entrustment contract fully specifying the handling method and the monitoring measures; Evidence of technical segregation between entrusted data and the vendor’s own data; Internal controls and access logs preventing own-purpose use; Records of any reliance on the emergency exception

Where the individual is under 16, consent and notification must be directed to their legal representative, subject to exceptions (the operator has a legitimate reason for not knowing the individual is under 16; the representative has authorised the individual’s business and the data was acquired in connection with it; the individual has no legal representative). The grounds for that individual to demand suspension of use of retained personal data are relaxed, and a new duty requires operators handling minors’ personal information to give priority to the minor’s best interests according to age and stage of development and to endeavour to take the measures necessary to avoid harming their rights and interests.

Evidence: Age-assurance mechanism and accuracy assessment records; Legal-representative consent workflow and records; Best-interests assessment documentation for minors; Description of feature restrictions and default settings applied to minors

Personally referable information containing descriptions that allow contact with a specific individual — location such as residence or workplace, telephone number, email address, Cookie ID and the like — becomes subject to the same prohibitions on improper use and improper acquisition as personal information, as do pseudonymously and anonymously processed information containing such descriptions. Acquiring such data by deception, or using it to facilitate unlawful acts, is therefore unlawful even where the data is not “personal information” in the holder’s hands.

Evidence: Lawfulness checks on the source of personally referable information; Supplier due diligence and contractual undertakings; Permitted-use and prohibited-use list including a ban on facilitating unlawful acts; Description of the acquisition method and the user-facing notice

The surcharge is calculated on the financial benefit obtained from the violating conduct, and is limited by whether the operator failed to exercise due care. Companies should therefore build and retain evidence of due care — compliance reviews, source-of-data checks, internal approvals; maintain a dedicated register for processing touching Arts. 19, 20(1) and 27(1) and the statistics exception; and be able to separate revenue related to the conduct from unrelated revenue in an investigation. The official outline uses a benchmark of 1,000 data subjects for the large-scale condition.

Evidence: Due-care evidence pack: reviews, approvals, training; Dedicated register of high-risk processing activities; Revenue attribution methodology and working papers for the processing concerned; Records of suspension and remediation once an issue is found

Before providing personal data to a third party under the notified opt-out regime, the provider must first confirm the recipient’s identity (name, address and representative) and purpose of use. Making false statements about the matters confirmed is subject to a non-penal fine. Exceptions apply where, at the time of acquisition, the data had been made public by the individual, a national body or a local government.

Evidence: Records confirming the recipient’s identity and purpose of use; Opt-out notification filing; Recipient due diligence and contract clauses; Evidence supporting reliance on the public-source exception

Because the Act creates no penalties, approvals or filings, AI compliance in Japan must be assessed under existing law: the APPI (including the 2026 amendment), the Copyright Act (training and outputs), the Unfair Competition Prevention Act, product liability law, and sectoral regulation in finance, healthcare, automotive and telecommunications. Internally, companies should maintain an explicit mapping recording that the Japanese AI Act creates no standalone duties while the relevant duties sit in other statutes, so that the Act is not mistaken for a compliance clearance.

Evidence: Mapping of Japanese AI-relevant legal duties to statutes and owning functions; Compliance status assessment under each applicable statute; Legal-change monitoring mechanism and review records

Article 7 defines a “utilisation business” as a person intending to develop or supply products or services using AI-related technologies, or otherwise to use such technologies in business activities. It requires them to endeavour, in line with the basic principles, to make their operations more efficient and advanced and to create new industries through active use of AI, and to cooperate with measures implemented by the State under Art. 4 and by local governments under Art. 5. This is a responsibility clause, not a sanctionable duty; in practice it means responding to government surveys, taking part in guideline and standards development, and answering requests for information.

Evidence: Correspondence records of cooperation with government surveys and information requests; Records of participation in guideline or standards development; Internal AI utilisation policy document

Article 13 requires the State to develop guidelines consistent with international norms, and take other necessary measures, to ensure the appropriate conduct of AI research, development and use; Article 18 requires the government to adopt an AI Basic Plan. Companies should treat both as the baseline governance expectation for the Japanese market, fold them into their internal AI governance, and answer against them in public procurement and large-customer due diligence. The AI Basic Plan was adopted by Cabinet decision on 23 December 2025.

Evidence: Mapping table between internal AI governance policy and the State guidelines; Tracking record of Basic Plan measures relevant to the business; Working papers for due-diligence questionnaire responses

ISO/IEC 42001 AI management system implementation and certification readiness checklist